Where Classification Data Comes From

IdentityIQ's classification functions are designed to integrate with SailPoint's File Access Manager module, to provide robust and seamless governance of sensitive data.

You can also implement classifications using data from sources other than File Access Manager, allowing you to tailor your classifications solution to your particular business needs.

In File Access Manager, classification categories are assigned to Business Resources (folders). Classifications typically flag sensitive data, but can flag anything you configure File Access Manager to monitor. In many cases, access to classified data is granted through account groups – most typically, Active Directory Groups – such that users' membership in those groups indirectly grants access to that data. For example, a company's Human Resources group might have access to employees' personal data, or a hospital's group of doctors might have access to medical records. When you include File Access Manager's classification data in your IdentityIQ installation, you can see the implications of users' existing and requested group memberships, to better inform your access governance decisions in IdentityIQ.

For more information about how data is classified in File Access Manager, refer to the File Access Manager documentation.

You can bring classification data into IdentityIQ from sources other than File Access Manager, or define your classification data independently in IdentityIQ, by importing the classification data as an XML object. To import an XML object, use the iiq console or the gear menu > Global Settings > Import From File feature.

Here is an example of what a classification object might look like. This example includes a name, display name, source of origin for the data, and localized descriptions for the classification.

Copy 
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Classification PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Classification id="" name="PHI" displayName="Protected Health Information" origin="MyIndependentDataSource">
  <Attributes>
    <Map>
      <entry key="sysDescriptions">
        <value>
          <Map>
           <entry key="en_US" value="Allows access to Protected Health Information"/>
           <entry key="fr_FR" value="Permet l’accès aux informations de santé protégées"/>
          </Map>
        </value>
      </entry>
    </Map>
  </Attributes>
</Classification>